Violations as defined in statute by the GDPR, which applies to anyone who collects PII on people within the EU. The ISP thing? I'd expect EU VPNs to start selling pretty well.